From 8a26fa0508e69f7cdc1680db57c4d8983a70de84 Mon Sep 17 00:00:00 2001 From: rxy Date: Mon, 29 Apr 2019 05:04:01 +0900 Subject: [PATCH] SECURITY: Add permission check for user is permitted to view the log type Bug: T222036 Change-Id: I7584ee8db23a8834bbab21e355cab9857a293f72 --- includes/changetags/ChangeTagsLogItem.php | 2 +- includes/specials/SpecialEditTags.php | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/includes/changetags/ChangeTagsLogItem.php b/includes/changetags/ChangeTagsLogItem.php index 75b713ef0d..2bac909716 100644 --- a/includes/changetags/ChangeTagsLogItem.php +++ b/includes/changetags/ChangeTagsLogItem.php @@ -49,7 +49,7 @@ class ChangeTagsLogItem extends RevisionItemBase { } public function canView() { - return LogEventsList::userCan( $this->row, Revision::DELETED_RESTRICTED, $this->list->getUser() ); + return LogEventsList::userCan( $this->row, Revision::SUPPRESSED_ALL, $this->list->getUser() ); } public function canViewContent() { diff --git a/includes/specials/SpecialEditTags.php b/includes/specials/SpecialEditTags.php index ed398deae4..6ef6cb3f7d 100644 --- a/includes/specials/SpecialEditTags.php +++ b/includes/specials/SpecialEditTags.php @@ -227,6 +227,9 @@ class SpecialEditTags extends UnlistedSpecialPage { $list = $this->getList(); for ( $list->reset(); $list->current(); $list->next() ) { $item = $list->current(); + if ( !$item->canView() ) { + throw new ErrorPageError( 'permissionserrors', 'tags-update-no-permission' ); + } $numRevisions++; $out->addHTML( $item->getHTML() ); } -- 2.20.1